Affected versions of MISP (up to 2.5.45) validate the user-configurable homepage by only verifying that the supplied path begins with a slash (/). This check is inadequate because protocol-relative URLs such as //attacker.example also start with a slash but resolve to external origins in browsers, allowing unsafe redirects. The vulnerable homepage value can be saved as a user setting and used by the post-login routing logic, where it is emitted to the Location header after login. The fix involves introducing an InternalRedirectValidator that rejects URLs containing hosts, schemes, userinfo, unsafe leading // or /\ sequences, malformed URLs, and control characters. It also revalidates homepage settings on read to prevent legacy unsafe values from bypassing validation.

This vulnerability allows an attacker to configure a homepage URL that appears valid but actually redirects users to an external, potentially malicious site after login. This can lead to phishing or other social engineering attacks by redirecting authenticated users to attacker-controlled domains. The impact is limited to unsafe redirects post-login and does not indicate direct code execution or data leakage.

No official patch link is provided in the data, and patch status is not yet confirmed. Check the vendor advisory for current remediation guidance. The described fix involves implementing an InternalRedirectValidator that performs strict validation on homepage URLs to reject unsafe values. Until a fix is applied, users should avoid setting homepage URLs that begin with // or contain other unsafe patterns. Monitor vendor communications for an official fix or update.